Transaction authorization method and system

1. A method for authorizing a transaction, the method comprising the following acts performed by a telecommunications server configured to act as an authentication provider:

at least one preparatory phase; and

at least one authorization phase;

wherein the at least one preparatory phase comprises for each of several user accounts:

registering a user account via a user terminal;

registering a plurality of personal devices with the registered user account, wherein registering of a personal device comprises registering an authentication application installed in that personal device;

wherein the authentication application in the registered personal device is configured to:

indicate at least a subset of received transaction-specific details via a user interface;

receive transaction-specific instructions via the user interface; and

digitally sign the transaction-specific instructions by using a cryptographic private key assigned to the user account;

wherein the at least one authorization phase performed by the telecommunications server comprises for each of several transactions related to one of the several user accounts:

receiving knowledge of a transaction relating to a user of a user terminal;

determining, in response to receiving the knowledge, a user account related to the transaction;

receiving a request for details specific to the transaction from at least one personal device;

checking, whether the at least one personal device wherefrom the request is received belongs to the plurality of personal devices registered with the user account determined to relate to the transaction;

providing, in response to the at least one personal device wherefrom the request is received belonging to the plurality of personal devices registered with the user account determined to relate to the transaction, the requested details specific to the transaction to the authentication application in the at least one personal device wherefrom the request for details specific to the transaction were received;

receiving, after the providing, from the authentication application in the at least one personal device a digitally signed transmission which indicates transaction-specific instructions received via the user interface by the authentication application in the at least one personal device; and

authorizing or denying the transaction based on the received transaction-specific instructions.

2. The method according to claim 1 , further comprising establishing a trust relationship between the authentication provider and at least one service provider.

3. The method according to claim 2 , wherein said establishing the trust relationship comprises exchanging a shared cryptographic secret between the authentication provider and the at least one service provider.

4. The method according claim 2 , wherein said establishing the trust relationship comprises mutual authentication by means of one or more public key infrastructure certificates.

5. The method according to claim 1 , further comprising establishing a trust relationship between the authentication provider and the at least one authentication application.

6. The method according to claim 5 , wherein said establishing the trust relationship between the authentication provider and the at least one authentication application comprises provisioning a public key infrastructure certificate from the authentication provider to the authentication application.

7. The method according to claim 5 , wherein said establishing the trust relationship between the authentication provider and the at least one authentication application comprises using a shared secret key and authentication application private key.

8. The method according to claim 1 , wherein said registering of the authentication application comprises causing transmission of the authentication application to at least one of the registered personal devices.

9. The method according to claim 1 , wherein the authentication provider maintains a plurality of different security policies and applies a subset of the maintained security policies depending on a type and/or platform of the personal device that comprises the authentication application from which the authentication provider receives the digitally signed transmission.

10. The method according to claim 9 , wherein the subset of applied security policies requires one or both of:

performing the transaction using a first personal device and separately authorizing it using a second personal device, which is separate from the first personal device; and

authorizing the transaction by using at least two separate personal devices.

11. The method according to claim 9 , wherein the subset of applied security policies requires that the separate personal devices comprise at least two personal devices of a different type and/or platform.

12. The method according to claim 9 , wherein the subset of applied security policies requires that a personal device of a specific type and/or platform must be used or must not be used for authorizing the transaction.

13. The method according to claim 9 , wherein the subset of applied security policies depends on a financial value of the transaction and/or a history of the user account.

14. A data processing system comprising:

a memory system for storing program code instructions and data;

a processing system including at least one processing unit, wherein the processing system executes at least a portion of the program code instructions and processes the data;

wherein the memory system stores program code instructions that, when executed by the processing system, instruct the processing system to act as an authentication provider configured to perform the following acts:

at least one preparatory phase; and at least one authorization phase;

wherein the at least one preparatory phase comprises for each of several user accounts:

registering a user account via a user terminal;

registering a plurality of personal devices with the registered user account, wherein registering of a personal device comprises registering an authentication application installed in that personal device;

wherein the authentication application in the registered personal device is configured to:

indicate at least a subset of received transaction-specific details via a user interface;

receive transaction-specific instructions via the user interface; and

digitally sign the transaction-specific instructions by using a cryptographic private key assigned to the user account;

wherein the at least one authorization phase performed by the processing system comprises for each of several transactions related to one of the several user accounts:

receiving knowledge of a transaction relating to a user of a user terminal;

determining, in response to receiving the knowledge, a user account related to the transaction;

receiving a request for details specific to the transaction from at least one personal device;

checking, whether the at least one personal device wherefrom the request is received belongs to the plurality of personal devices registered with the user account determined to relate to the transaction;

providing, in response to the at least one personal device wherefrom the request is received belonging to the plurality of personal devices registered with the user account determined to relate to the transaction, the requested details specific to the transaction to the authentication application in the at least one personal device wherefrom the request for details specific to the transaction were received;

receiving, after the providing, from the authentication application in the at least one personal device a digitally signed transmission which indicates transaction-specific instructions received via the user interface by the authentication application in the at least one personal device; and

authorizing or denying the transaction based on the received transaction-specific instructions.

15. A non-transitory computer program carrier comprising program code instructions executable in a data processing system, which is operationally connectable to a user terminal, a plurality of personal devices managed by a user of the user terminal, and to at least one service provider, wherein execution of the program code instructions in the data processing system causes the data processing system to carry out a method, which comprises:

at least one preparatory phase; and

at least one authorization phase;

wherein the at least one preparatory phase comprises for each of several user accounts:

registering a user account via a user terminal;

registering a plurality of personal devices with the registered user account, wherein registering of a personal device comprises registering an authentication application installed in that personal device;

wherein the authentication application in the registered personal device is configured to:

indicate at least a subset of received transaction-specific details via a user interface;

receive transaction-specific instructions via the user interface; and

digitally sign the transaction-specific instructions by using a cryptographic private key assigned to the user account;

wherein the at least one authorization phase performed by the data processing system comprises for each of several transactions related to one of the several user accounts:

receiving knowledge of a transaction relating to a user of a user terminal;

determining, in response to receiving the knowledge, a user account related to the transaction;

receiving a request for details specific to the transaction from at least one personal device;

checking, whether the at least one personal device wherefrom the request is received belongs to the plurality of personal devices registered with the user account determined to relate to the transaction;

providing, in response to the at least one personal device wherefrom the request is received belonging to the plurality of personal devices registered with the user account determined to relate to the transaction, the requested details specific to the transaction to the authentication application in the at least one personal device wherefrom the request for details specific to the transaction were received;

receiving, after the providing, from the authentication application in the at least one personal device a digitally signed transmission which indicates transaction-specific instructions received via the user interface by the authentication application in the at least one personal device; and

authorizing or denying the transaction based on the received transaction-specific instructions.